CVE-2026-1323 json
Insecure Deserialization in extension "Mailqueue" (mailqueue)
published 7mo ago modified 4mo ago also GHSA-2pm6-9fhx-vvg3 , EUVD-2026-12548
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
Patch / fix
- packagist cpsit/typo3-mailqueue 0.4.5, 0.5.2
- TYPO3 Extension "Mailqueue" 0.4.5, 0.5.2
Is CVE-2026-1323 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7mo ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.2 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H |
| CNA | 4.0 | 5.2 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | cpsit/typo3-mailqueue | <0.4.5 >=0.5.0, <0.5.2 |
0.4.5 0.5.2 |
Affected products
- TYPO3 Extension "Mailqueue"
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/CPS-IT/mailqueue/commit/0f7a1376bbbd8c7658030d02e51c10a85b1dfdf7
web
-
github.com
/CPS-IT/mailqueue/commit/600c7dba99f8eea5f2505b848ee3dd4713440741
web
-
typo3.org
/security/advisory/typo3-ext-sa-2026-005
vendor-advisory, web
-
github.com
/CPS-IT/mailqueue/security/advisories/GHSA-2pm6-9fhx-vvg3
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-1323
advisory
-
github.com
/CPS-IT/mailqueue
package
Sources
- CVE List CVE-2026-1323
- GitHub Advisory GHSA-2pm6-9fhx-vvg3
- NVD CVE-2026-1323
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.